@gajae-code/coding-agent 0.13.3 → 0.14.0

package/src/sdk/elevation/owner.ts

@@ -1,109 +0,0 @@
-import * as fs from "node:fs/promises";
-import { isPidAlive } from "../broker/discovery";
-import { isProcessIncarnation, processIncarnation } from "../broker/process-incarnation";
-
-/**
- * Broker-owner principal.
- *
- * The elevation authority is the broker itself under the existing loopback
- * trust model: one local OS-user/broker authority derived entirely from
- * broker-owned state, never from caller input. `agentDirUid` is the uid that
- * owns the agent directory, `brokerPid`/`brokerIncarnation` identify the
- * broker process tenure so a restarted broker cannot attest the same
- * authority.
- */
-export interface BrokerOwnerPrincipal {
-	kind: "broker_owner";
-	owner: {
-		agentDirUid: number;
-		brokerPid: number;
-		brokerIncarnation: string;
-	};
-}
-
-export function isBrokerOwnerPrincipal(value: unknown): value is BrokerOwnerPrincipal {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const principal = value as { kind?: unknown; owner?: unknown };
-	if (principal.kind !== "broker_owner") return false;
-	if (typeof principal.owner !== "object" || principal.owner === null) return false;
-	const owner = principal.owner as { agentDirUid?: unknown; brokerPid?: unknown; brokerIncarnation?: unknown };
-	return (
-		Number.isSafeInteger(owner.agentDirUid) &&
-		(owner.agentDirUid as number) >= 0 &&
-		Number.isSafeInteger(owner.brokerPid) &&
-		(owner.brokerPid as number) > 0 &&
-		isProcessIncarnation(owner.brokerIncarnation)
-	);
-}
-
-export function sameBrokerOwnerPrincipal(left: BrokerOwnerPrincipal, right: BrokerOwnerPrincipal): boolean {
-	return (
-		left.kind === right.kind &&
-		left.owner.agentDirUid === right.owner.agentDirUid &&
-		left.owner.brokerPid === right.owner.brokerPid &&
-		left.owner.brokerIncarnation === right.owner.brokerIncarnation
-	);
-}
-
-/**
- * Reads the broker-owner principal from broker-owned state. Throws when the
- * broker cannot attest a canonical process incarnation (the broker refuses to
- * start in that case anyway), so callers treat a throw as "authority
- * unavailable".
- */
-export async function readBrokerOwnerPrincipal(
-	agentDir: string,
-	brokerPid: number,
-	brokerIncarnation: string,
-): Promise<BrokerOwnerPrincipal> {
-	if (!Number.isSafeInteger(brokerPid) || brokerPid <= 0)
-		throw new Error("Broker owner principal requires a live broker pid");
-	if (!isProcessIncarnation(brokerIncarnation))
-		throw new Error("Broker owner principal requires a canonical broker process incarnation");
-	const stat = await fs.stat(agentDir);
-	return {
-		kind: "broker_owner",
-		owner: {
-			agentDirUid: stat.uid,
-			brokerPid,
-			brokerIncarnation,
-		},
-	};
-}
-
-export type ProcessIncarnationLiveness = "alive" | "dead" | "unknown";
-
-/**
- * Tri-state liveness of a process incarnation.
- *
- * - `alive`: the pid is running and its current incarnation matches the
- *   stored one, so the original process tenure is still live.
- * - `dead`: ESRCH (the pid is provably gone — independent of any persisted
- *   incarnation text), or the pid is running under a *different* canonical
- *   incarnation (PID reuse), which provably means the original process
- *   ended.
- * - `unknown`: the pid is malformed, the persisted or observed incarnation
- *   is malformed/undefined, or the current incarnation cannot be read.
- *   Unknown never implies death: elevation claims must fail closed with
- *   `elevation_claim_in_progress` instead of terminalizing state on
- *   unprovable liveness.
- *
- * ESRCH is independent positive death proof: a pid that provably does not
- * exist is dead regardless of the persisted incarnation text, so a corrupt
- * persisted incarnation can never stall recovery forever.
- */
-export function classifyProcessIncarnationLiveness(pid: unknown, incarnation: unknown): ProcessIncarnationLiveness {
-	if (typeof pid !== "number" || !Number.isSafeInteger(pid) || pid <= 0) return "unknown";
-	// ESRCH is positive death proof even with malformed persisted
-	// incarnation text (AC-L6): the pid no longer exists, so the original
-	// tenure provably ended and recovery may proceed.
-	if (!isPidAlive(pid)) return "dead";
-	// The pid is alive (or EPERM): a malformed/undefined persisted
-	// incarnation cannot be compared, and a malformed/undefined observed
-	// incarnation cannot be trusted, so liveness is unprovable. Unknown
-	// never authorizes mutation.
-	if (!isProcessIncarnation(incarnation)) return "unknown";
-	const current = processIncarnation(pid);
-	if (!isProcessIncarnation(current)) return "unknown";
-	return current === incarnation ? "alive" : "dead";
-}

package/src/session/auth-broker-config.ts

@@ -1,109 +0,0 @@
-/**
- * Resolve auth-broker connection configuration for the local gjc client.
- *
- * Precedence (highest first):
- *   1. `GJC_AUTH_BROKER_URL` / `GJC_AUTH_BROKER_TOKEN` env vars.
- *   2. `auth.broker.url` / `auth.broker.token` in `~/.gjc/agent/config.yml`
- *      (hidden from the settings UI; `!command` resolution supported).
- *   3. Token file `~/.gjc/auth-broker.token` (paired with URL from env or config).
- *
- * Returns null when no broker URL is configured — caller falls back to the
- * local SQLite store.
- *
- * Reads config.yml directly (instead of going through `Settings.init`) because
- * `discoverAuthStorage` runs before the settings singleton is initialized in
- * `runRootCommand`, and we want hand-edited config entries to be honoured at
- * boot without forcing a startup reorder.
- */
-import * as path from "node:path";
-import { $credentialEnv, getAgentDir, getConfigRootDir, isEnoent, logger } from "@gajae-code/utils";
-import { YAML } from "bun";
-import { resolveConfigValue } from "../config/resolve-config-value";
-
-export interface AuthBrokerClientConfig {
-	url: string;
-	token: string;
-}
-
-/** Path to the local bearer token file. Created on the broker host by `gjc auth-broker token`. */
-export function getAuthBrokerTokenFilePath(): string {
-	return path.join(getConfigRootDir(), "auth-broker.token");
-}
-
-async function readTokenFile(): Promise<string | null> {
-	try {
-		const raw = await Bun.file(getAuthBrokerTokenFilePath()).text();
-		const trimmed = raw.trim();
-		return trimmed.length > 0 ? trimmed : null;
-	} catch (err) {
-		if (isEnoent(err)) return null;
-		logger.warn("auth-broker token file unreadable", { error: String(err) });
-		return null;
-	}
-}
-
-interface ConfigSnapshot {
-	url?: string;
-	token?: string;
-}
-
-async function readConfigYaml(): Promise<ConfigSnapshot> {
-	const configPath = path.join(getAgentDir(), "config.yml");
-	try {
-		const raw = await Bun.file(configPath).text();
-		const parsed = YAML.parse(raw);
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
-		const record = parsed as Record<string, unknown>;
-		const url = typeof record["auth.broker.url"] === "string" ? (record["auth.broker.url"] as string) : undefined;
-		const token =
-			typeof record["auth.broker.token"] === "string" ? (record["auth.broker.token"] as string) : undefined;
-		return { url, token };
-	} catch (err) {
-		if (isEnoent(err)) return {};
-		logger.warn("auth-broker config.yml unreadable", { error: String(err) });
-		return {};
-	}
-}
-
-/**
- * Read broker configuration. Returns null when the URL is missing
- * (broker disabled — local store is used). Throws when URL is set but no
- * token is available — the caller cannot fall back silently because the
- * user explicitly asked to use the broker.
- */
-export async function resolveAuthBrokerConfig(): Promise<AuthBrokerClientConfig | null> {
-	// Trusted sources only: this URL and token select the credential store the
-	// agent uses for every provider, so whatever can set them can serve the
-	// credentials the agent authenticates with and receive the ones it writes
-	// back. `$env` merges the caller's `cwd/.env`, so reading them there would let
-	// repository content replace the store wholesale. Resolve them the same way
-	// the credentials themselves are: launching shell plus GJC/user-owned `.env`
-	// files, never the project `.env`.
-	const envUrl = $credentialEnv("GJC_AUTH_BROKER_URL");
-	const envToken = $credentialEnv("GJC_AUTH_BROKER_TOKEN");
-
-	let url = envUrl && envUrl.length > 0 ? envUrl : undefined;
-	let configToken: string | undefined;
-	if (!url || !envToken) {
-		const fromConfig = await readConfigYaml();
-		if (!url && fromConfig.url) {
-			const resolved = await resolveConfigValue(fromConfig.url);
-			if (resolved && resolved.length > 0) url = resolved;
-		}
-		if (fromConfig.token) {
-			const resolved = await resolveConfigValue(fromConfig.token);
-			if (resolved && resolved.length > 0) configToken = resolved;
-		}
-	}
-	if (!url) return null;
-
-	const token =
-		(envToken && envToken.length > 0 ? envToken : undefined) ?? configToken ?? (await readTokenFile()) ?? undefined;
-	if (!token) {
-		throw new Error(
-			`GJC_AUTH_BROKER_URL is set (${url}) but no bearer token is available. ` +
-				`Set GJC_AUTH_BROKER_TOKEN, the \`auth.broker.token\` config entry, or place one at ${getAuthBrokerTokenFilePath()}.`,
-		);
-	}
-	return { url, token };
-}